Forgery of Argo Server TLS Requests in github.com/argoproj/argo-workflows
Summary
GO-2022-0388: Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Argo Workflows is an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. It provides a declarative way to define workflows and execute them in a distributed manner. The package 'github.com/argoproj/argo-workflows' is a core component of Argo Workflows, responsible for handling server-side operations. Unfortunately, this package is vulnerable to TLS request forgery attacks.
Vulnerability Detail
The vulnerability in 'github.com/argoproj/argo-workflows' allows an attacker with network access to forge TLS requests. This means that an attacker can intercept and modify TLS requests sent to the Argo Server, potentially leading to unauthorized access, data tampering, or other malicious activities. The vulnerability affects all versions of the package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed versions as soon as possible.
Conclusion
The 'github.com/argoproj/argo-workflows' package is vulnerable to TLS request forgery attacks. It is crucial to update the package to versions 3.0.9 or 3.1.6 to mitigate this vulnerability and ensure the security of the Argo Workflows system.
See every vulnerability recorded for github.com/argoproj/argo-workflows →
FAQ
Argo Workflows is an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes.
The vulnerability allows an attacker to forge TLS requests, potentially leading to unauthorized access, data tampering, or other malicious activities.
All versions of 'github.com/argoproj/argo-workflows' are affected.
To fix this vulnerability, update the package to versions 3.0.9 or 3.1.6.
No, there is no known workaround. Updating the package is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-workflows.
